What dApps Are, and What Connecting Your Wallet Really Does
7 min read · Verified October 2026
A dApp (decentralised application) is an app whose core logic runs as smart contracts on a blockchain instead of on a company's servers. You use it through a normal-looking website and a crypto wallet. The contracts are public and can't easily be changed, but the website, the data feeds (oracles) and the admin keys often aren't decentralised at all.
A dApp looks like any other website. The difference is behind the "Connect wallet" button: the important logic doesn't run on the company's servers, it runs on a public blockchain where anyone can inspect it and nobody can quietly change it. That's the idea, anyway. How decentralised a given dApp really is varies a lot.
What makes an app "decentralised"?
A dApp has three parts:
- Smart contracts, programs deployed to a blockchain such as Ethereum, Solana or an Ethereum Layer 2. They hold the funds and enforce the rules.
- A front end, the website or app you click through. It builds transactions and asks your wallet to sign them.
- Your wallet, which holds your keys and signs on your behalf.
The contracts are the decentralised part. Once deployed, they run as written, their code is public, and they keep working even if the team disappears. You could interact with them directly without the official website at all.
Pro and Pro+ include 24/7 Portfolio Guardian, which watches for security events affecting what you hold and explains what happened and what to do.
What isn't decentralised?
Often more than the label suggests:
- The front end is usually hosted conventionally. It can be taken offline, geo-blocked, or hijacked through a DNS attack to serve a malicious version that drains wallets.
- Admin keys and upgradeability. Many contracts can be upgraded or paused by a team multisig. That's useful for fixing bugs and is also a point of trust.
- Oracles. Contracts can't see the outside world, so prices come from oracle services. A thin or manipulable price feed is the root cause of many flash loan exploits.
- Governance. Token voting is often controlled by a handful of large holders.
None of this makes dApps bad. It means "decentralised" describes a spectrum, and it's worth knowing where on it an app sits before you deposit money.
What can dApps do?
DeFi is the largest category. Decentralised exchanges let you swap tokens against liquidity pools instead of an order book. Lending markets let you deposit assets to earn interest or borrow against them. Derivatives protocols offer perpetual futures and options on-chain. Liquid staking lets you stake and keep a tradeable token representing your stake.
Beyond finance: NFT marketplaces, on-chain games, DAO tooling for collective treasuries and votes, prediction markets, and identity and naming services.
What happens when you connect and sign?
"Connect wallet" by itself just shares your public address. It doesn't move anything or give the site control. The risk is in what you sign afterwards.
Transactions do something on-chain right away: a swap, a deposit, a mint.
Token approvals let a contract spend a token from your wallet later, often up to an unlimited amount. Approvals are how DEXs and lending markets work, but they stay in force after you leave the site. If that contract is later exploited, or was malicious from the start, approved tokens can be taken without you signing anything else.
Off-chain signatures (messages, permits) can be just as powerful as approvals while looking harmless. Scam sites lean on these.
Good habits:
- Check the URL every time. Bookmark the dApps you use.
- Read what your wallet says you're approving, and prefer exact amounts over unlimited ones.
- Periodically review and revoke old approvals with a reputable approval checker.
- Keep long-term holdings in a wallet that never connects to dApps.
- Never enter your seed phrase on a website, for any reason. No legitimate app will ask.
Where does a tracker fit?
A portfolio tracker isn't a dApp and should never need to be one. Watching a wallet means reading public chain data for the addresses you add: no connection, no signature, no approval. If an app that claims to be a tracker asks you to sign or approve anything, that's a signal to stop. What a tracker can see covers the boundary in detail. Positions held inside dApps, like LP tokens, lending deposits and staked assets, are among the hardest things to value correctly, which is why tracking staked, pooled and lent assets has its own guide.
Common questions
DeFi (decentralised finance) is the largest category of dApps: exchanges, lending markets, derivatives and yield products built on smart contracts. Other dApps include NFT marketplaces, games, DAO governance tools and on-chain social apps.
Connecting alone shares your public address, which is already public on-chain. The risk is in what you sign afterwards. Token approvals can let a contract move your tokens later, and malicious signature requests can hand over assets directly. Read every prompt, and revoke approvals you no longer need.
A program deployed to a blockchain that runs exactly as written when someone sends it a transaction. Everyone can read its code and check its behaviour, and once deployed it usually can't be changed unless it was built to be upgradeable. That's both the appeal and the danger: bugs are as permanent as features.
A service that brings outside data onto the chain, most commonly prices, so smart contracts can use it. Contracts can't fetch data themselves. A weak oracle is a classic attack surface, because feeding a contract a false price can let an attacker borrow or withdraw far more than they should.
No. A tracker reads public chain data for the addresses you give it. It never needs your wallet to sign anything. If a 'tracker' asks you to sign a transaction or approve tokens, treat it as a red flag.
Track wallets across chains read-only, with no keys and no signing. Add the addresses and the app reads the chain.
Scan to install
Keep reading
How Liquidity Pools Work, and What Impermanent Loss Costs
How a liquidity pool prices trades without an order book, what liquidity providers earn, and how much impermanent loss costs at different price moves.
Flash Loans and Uncollateralised Lending
How flash loans let anyone borrow millions with no collateral for a single transaction, what they're used for, and why they show up in so many DeFi exploits.
The Main Types of Cryptocurrency
A practical map of the main types of cryptocurrency, from payment coins, smart contract platforms and stablecoins to wrapped tokens, memecoins and NFTs, and the risk that comes with each.
Nobody Legitimate Will Ever Ask for Your Seed Phrase
A seed phrase is the wallet, not a password for it. Why no real app or agent needs one, the scripts scammers use, and what to do if you shared it.
What a Portfolio Tracker Can Actually See
Balances and trade history, yes. Private keys, seed phrases and moving funds, no. What the app, the company and the public can each actually see.
How Counterfeit Crypto Apps Get Into App Stores
Counterfeit wallet apps clear store review regularly. How they get through, the signals that identify one, and how to verify the real listing.
Where Your Staked and Pooled Assets Went
Staked ETH, LP positions and lending receipts don't show up as the asset you deposited. Why DeFi totals read low and how to account for what's missing.
